Legal

Treg Privacy Policy

Last updated: 22 July 2026 Effective: 22 July 2026

The short version

We collect almost nothing about you. An email address to sign in, the teams you're in, and a log of which tools were called. That's the account.
Your credentials are encrypted and never returned. No stored secret value is ever sent back to a client, shown in the dashboard, or read by us.
We don't store what flows through the proxy. A call's request and response bodies pass through and are gone. We keep the method, path, status code, and timestamp — not the content.
No trackers. No analytics scripts, no advertising pixels, no third-party cookies. Two first-party cookies, both ours: one keeps you signed in, one (only if you arrived from a Google Ads click) tells us the ad worked.
No training, no selling. Your credentials, skills, and connected-account data are never sold and never used to train models.

01Who this covers

This policy explains how Superdesign ("we", "us") handles personal data in the hosted Treg (also called "treg" or "tools-registry") service at treg.to. For that service, we are the data controller.

Self-hosted instances are not covered. If you or your employer run treg on your own infrastructure, your data never reaches us and this policy doesn't apply — the operator of that instance is the controller.

Contact for anything privacy-related: jason@superdesign.dev.

02What we collect

Account and identity

Your email address — the only identifier we require. Used to sign you in, send one-time codes and team invitations, and attribute actions in the audit log.
Team names, your role in each team, and when you joined.
Token hashes. We store a SHA-256 hash of each access token, never the token itself.
Short-lived sign-in codes and rate-limit counters, which expire automatically.

We do not ask for your name, phone number, address, photo, date of birth, or payment details — the Service is free and we take no payment data at all.

Credentials and connections

Secret values you store (API keys, tokens, credential files), encrypted at rest with authenticated encryption. These are never returned through the API and never displayed after they're saved.
OAuth tokens from accounts you connect, plus the metadata needed to use them: the provider, the scopes you actually granted, the specific property or account you selected and its display name, and expiry/refresh timestamps.
Health status for each credential ("does this key still work"), from periodic validity checks.

Usage and audit records

For each proxied or local-run call: the caller's email, the tool name, HTTP method, request path, status code, and timestamp.
For each server-side CLI run: the caller's email, the tool name, the command arguments, exit code, and duration. Secret values are injected as environment variables, never as command-line arguments, so they don't appear here.

We do not record request or response bodies. The data you fetch from an upstream API passes through the proxy and is not written down. What survives a call is the metadata listed above — enough for a team admin to see who used what, and no more.

Content you create

Skills (SKILL.md text and companion files), tool definitions, and their upstream URLs. Treat skill text as visible to everyone in the team it lives in — don't put secrets there.

Technical data

Our hosting provider processes standard server logs (IP address, user agent, request line, timestamp) for security and abuse prevention, retained on their default schedule. We don't build profiles from them.

03Why we're allowed to hold it (legal bases)

Data	Purpose	Basis (GDPR Art. 6)
Email, team membership	Provide the account; sign-in; invitations	Contract
Stored credentials, OAuth tokens	Execute the calls you ask for; keep them valid	Contract
Call and run audit records	Show teams who used what; enforce caps; investigate abuse	Legitimate interests / Contract
Server logs, rate-limit counters	Security, abuse prevention, service reliability	Legitimate interests
Skills and tool definitions	Store and share what you asked us to share	Contract

04What we never do

We never sell personal data, credentials, or anything reached through them.
We never use your credentials, connected-account data, or skill content to train machine learning models — ours or anyone else's.
We never run advertising, analytics, or tracking scripts on our pages. There is no Google Analytics, no pixel, no session-replay, no third-party cookie.
We never use your stored credentials for anything other than the call you or a permitted teammate initiated, plus automated health checks and token refreshes.

05Google and YouTube user data — Limited Use

When you connect Google Search Console, Google Analytics, Google Business Profile, Google Ads, or YouTube, treg's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

Google user data is used only to provide and improve the features you connected it for — making the API calls you or your team initiate.
It is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you.
It is not used for advertising, and is not used to train generalized AI or ML models.
No human at Superdesign reads your Google user data, except with your explicit consent for a specific support issue, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized.
Disconnecting the provider in treg deletes the stored token. You can also revoke treg's access at any time from your Google account permissions page.

YouTube

The YouTube connection uses YouTube API Services. By connecting a YouTube channel you are additionally agreeing to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

What we receive. Only what the capability you chose asks for: the channels your Google account owns and their titles (so you can pick which channel a connection acts on), the videos you publish through treg and their metadata, and — where you granted it — comments and statistics for your own channel.
What we store. The OAuth token (encrypted), the scopes you granted, and the channel you selected with its display name. Video files you upload are streamed to YouTube and are not retained by us. We do not copy your video library, your viewers' data, or your analytics into our own store.
What we do with it. Only the calls you or a permitted teammate initiate, plus token refreshes and health checks. It is never used for advertising, never sold, and never used to train machine learning models.
Revoking access. Disconnect the provider in treg to delete the stored token, and/or revoke treg's access directly at Google security settings. Revoking there stops all further access immediately, whatever we hold.

The same commitments apply to every other provider you connect (LinkedIn, Slack, X, or an API you register yourself).

06Who we share it with

Only the processors we need to run the Service, plus the upstream providers you deliberately point us at.

Recipient	What they get	Why	Where
Render	Application hosting and the managed database — all stored data	Runs the Service	USA (Oregon)
Resend	Your email address and the message body	Sends sign-in codes and invitations	USA
Google Fonts	Your IP address, when you load a treg web page	Serves the site's typefaces	USA
Upstream APIs you connect	Whatever your call sends them	The call you asked us to make	Varies by provider
Google Ads	A click id and a conversion event (signup, first call, or first payment) — only if you arrived via a Google Ads click	Measures whether the ad that brought you converted	USA

Referrals. If you sign up through someone's referral link, your email address is shown to the person who referred you, along with the date you signed up and whether your team has added funds — that's how they see which of their invitations worked. Nothing else about you or your usage is shared with them. If you'd rather not be visible that way, sign up without using the link.

In the other direction we show you less: if you were referred, we tell you who invited you as a partial address (j•••@theirdomain.com) and never in full. Referral links are often shared publicly, and the full address of whoever posted one is not ours to hand to everyone who clicks it.

We'll also disclose data where legally required, or where necessary to protect the Service or its users from a live security threat. If we're ever compelled to hand over data about you, we'll tell you unless we're legally barred from doing so.

If treg is ever acquired or merged, data may transfer as part of that transaction — you'd be notified in advance and this policy would continue to apply until replaced by one that is no less protective.

07Cookies

treg_session: HTTP-only, SameSite=Lax, secure over HTTPS. It holds a signed session reference and nothing else. It's strictly necessary to keep you signed in, so there's no consent banner and nothing to opt out of short of signing out.

treg_oauth_return and treg_ref: both HTTP-only with the same flags, and both exist only when you've done the thing that sets them. The first holds the page to return you to after a sign-in detour (a few minutes). The second holds a referral code if you arrived through someone's invite link, so we can credit them when you create a team (30 days). Neither identifies you, and neither is used for advertising.

treg_ad: set by our own /adtrack.js, not a Google script — if you arrive from a Google Ads click, it records which ad click led to your visit (the click id and the landing page), retained for 90 days. It exists to tell us whether an ad turned into a signup, an active agent, or a paying team, so we can tell which ads to keep running. It is first-party (set by treg.to, readable only by us, never by Google or any other third party) and it is not shared with third parties beyond the conversion event itself — a signup, a first call, or a first payment, each tagged with only the click id — uploaded to Google Ads so it can measure the campaign. There is no advertising pixel, no third-party cookie, and no cross-site tracking script anywhere on the Service.

08How we protect it

Secret values and OAuth tokens are encrypted at rest with a key held outside the database.
Access tokens are stored only as SHA-256 hashes; a database leak doesn't yield usable tokens.
All traffic is over HTTPS. Every record is scoped to an organization, and access is checked per request against your membership, role, and per-member tool list.
Server-side runs execute in a sandbox with filesystem and network egress restrictions.
Bumping your token version revokes every token you hold at once, immediately.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we'll notify affected users and any required regulator without undue delay.

09How long we keep it

Data	Retention
Account, teams, memberships	Until you delete the account
Credentials and OAuth tokens	Until you delete them, disconnect the provider, or delete the team
Skills and tool definitions	Until deleted by you or a team admin
Call and run audit records	While the owning team exists; deleted with it
Sign-in codes, rate-limit counters	Minutes — expired rows are swept automatically
Invitations	Until accepted, revoked, or expired
Hosting server logs	Our provider's default window (short)

Deletions are permanent in the live database. Encrypted backups may retain a copy for a short period before rotating out.

10Your rights

Wherever you live, you can ask us to access, correct, export, or delete your data, and to restrict or object to processing. Depending on your location (EEA/UK under the GDPR, California under the CCPA/CPRA, and similar laws elsewhere) some of these are formal legal rights; we honour all of them for everyone regardless.

Self-serve: the dashboard lets you delete credentials, tools, skills, and whole teams, and revoke all your tokens.
Everything else: email jason@superdesign.dev. We'll respond within 30 days and won't charge you or treat you differently for asking.

California residents: we do not sell or share personal information as those terms are defined by the CPRA, and we have not done so in the preceding 12 months.

EEA/UK residents: you also have the right to lodge a complaint with your local supervisory authority. Data is processed in the United States; where a transfer mechanism is required, we rely on the Standard Contractual Clauses offered by our processors.

11Children

The Service isn't intended for anyone under 16, and we don't knowingly collect their data. If you believe a child has created an account, email us and we'll delete it.

12Changes to this policy

We'll update this page when our practices change, and the "last updated" date always reflects the current version. For material changes — new categories of data, a new processor, or a new purpose — we'll notify account holders by email or an in-app notice before the change takes effect.

13Contact

Privacy questions, requests, or complaints: jason@superdesign.dev. Security vulnerabilities: SECURITY.md.

See also the Terms of Service. Treg is open source — if you'd rather verify than trust, the code that does all of the above is public.